JP2024507012A - Payment cards, authentication methods, and use for remote payments - Google Patents

Abstract

The invention relates to a payment card (1) comprising on one side (10, 11) at least one authentication cipher (3), which authentication cipher (3) is unique, belongs to the payment card (1) and is authenticated. A code (3) is attached to the payment card (1), said authentication code (3) forming means for identifying the payment card (1) by optical recognition, said identification means being linked to the payment card (1). linked to your bank account. The present invention also authenticates the payment card (1) and the holder (100) of the payment card (1) in order to perform secure operations regarding the personal data of the holder (100) of the payment card (1). Regarding the method. Finally, the invention relates to the use of an authentication method for making remote payments using a payment card (1). [Selection diagram] Figure 6

Description

The invention belongs to the field of securing financial transactions by bank cards, more particularly remote bank payments carried out over the Internet.

It should be noted that a bank card is a card made of plastic, paper or cardboard, a few centimeters on each side and two millimeters thick. Cards traditionally carry at least one integrated circuit that can contain information. This integrated circuit corresponds to a chip and may include a microprocessor capable of processing this information, or may be limited to non-volatile memory circuitry and may optionally include security components such as a memory card. .

When making a remote payment with a bank card, it is necessary to provide the bank card's "security data" in order to carry out the financial transaction.

These security data are generally stamped on one or the other side of this chip card. Typically, a bank card contains data to identify the bank account and/or the bank card owner. These identification data are generally stamped on the front side of the bank card. More specifically, a card number, also called a PAN number, is linked to a bank account. In addition, most bank cards contain on the one hand the identification information of the bank card owner (first and last name and/or company name). Additionally, the banking organization also stamps the expiry date of the payment card.

These data for identifying the account and/or owner of the chip card are generally entered by printing or embossment on the front side of the bank card. Generally, these markings are carried out by embossing techniques (on the front side) of the chip card or by screen printing.

Most bank cards also include a security code or visual code affixed to the back (or back) of the bank card.

In practice, the owner or holder of a bank card is prompted to provide these identification data when making an online or telephone payment.

Since the early 21st century, electronic commerce and online payments more generally have grown exponentially, both in terms of the number of transactions and the financial volume of these transactions.

In the face of this increase in online payment volumes, cybersecurity issues seem critical. Indeed, parallel to this increase in online payments, an increase in bank card fraud is also observed, especially through online or telephone hacking.

Among these numerous types of fraud, two types can be distinguished. One uses a bank card and is called CP if a card is present, and the other is called CNP if no card is present. The first type of fraud involves the physical theft of a bank card, allowing a hacker in possession of this stolen card to also steal the identity of the bank card holder in order to perform online payments. have access to security data. Visual hacking of security data can also be compared to this first type of fraud through identity theft. In fact, visual hacking, as a rule, takes place during store payments, where the merchant copies security data without knowing the owner/carrier of the card. The hacker is then in possession of the bank card's security data and can perform remote transactions for himself or to resell them to third parties.

Phishing is a second type of fraud that involves identity theft. This technology is definitely one that has evolved in recent years. This technology tricks victims into identifying themselves as a trusted third party, such as a bank or government agency, in order to extract personal information (passwords, credit card numbers, ID numbers or photocopies, date of birth, etc.) The goal is to convince This can be done by reproducing the entire website, by sending an email, or by sending a text message. As a result, the hacker has the bank card's security data, which also allows him to carry out transactions to his own account.

To prevent this type of fraud, banking organizations have introduced methods to secure payments by sending payment confirmation text messages (SMS) to bank card holders' mobile phones. This text message typically includes an alphanumeric code sent by the financial institution to validate the payment. This service has a certification named "3D-Secure(R)". Although this system provides some security, it has several weaknesses that allow hackers to bypass it. First, not all banks offer such services. Similarly, not all payment systems used by commercial sites allow the use of this method to secure financial transactions. In fact, currently only 40% of online transactions in France are approved by this system. Additionally, the system allows changing the phone number to which the alphanumeric code is sent. This is a boon for hackers, allowing them to bypass the sending of alphanumeric codes to their own phones.

These shortcomings have forced the European Commission, in a recent decision, to establish new, more stringent European standards that require a higher level of security regarding online payments. The ambitious schedule for applying the new standards, aimed at enabling these new standards in 2021, has major drawbacks, namely the risk of non-standardization, which discourages banks from choosing their own solutions. involves enabling.

Alternative solutions exist to secure transactions. For example, there are types of bank cards that include dynamic CVV encryption. The CVV cipher generally corresponds to a series of three numbers on the front of a bank card.

The CVV cipher is called dynamic because the series of three numbers changes randomly, automatically, and regularly. Therefore, it is possible to confidently trust information from a dynamic bank card for online transactions. In fact, even in the case of phishing, bank card security data cannot be used because the encryption changes regularly.

Bank cards with dynamic encryption only partially address the phishing problem. This does not address the problem of physical theft of bank cards. In addition to the fact that the technology embedded in such cards is technologically advanced, especially by incorporating both the battery and the screen into the thickness of the card, this technology is very costly and non-eco-friendly. , and this has delayed universal adoption.

It is noted that the applicant has already proposed solutions to deal with identity theft following physical theft and/or visual hacking of bank cards. This solution proposes to integrate a code instead of the three digits in the bank card PAN number. This solution is described in particular in WO 2020/120849. Although in possession of a bank card, the hacker does not have all the security data necessary to make online payments himself. In fact, the owner of this type of bank card receives, on the one hand, a bank card in which part of the PAN number is hidden, and, on the other hand, a hidden number. This hidden number can be revealed by a digital method developed by the applicant, which is also the subject of FR 2005961.

This solution of encrypting bank card PAN numbers has been proven to be effective against physical theft and/or visual theft of bank cards, while preventing phishing of bank card security data. It is not possible.

As a result, it should be noted that at the time of writing this document, banking organizations and online merchants have not yet found adequate solutions to secure online transactions with bank cards.

In order to overcome these shortcomings, the applicant has developed a technical solution aimed at making online payments secure through two-factor authentication that guarantees the authentication of the bank card and the holder of said bank card. .

A first aspect of the invention relates to a payment card comprising a front side and a back side, the payment card also comprising an electronic chip, the front side carrying at least one PAN number, the identification information of the holder of the payment card, and the validity of the payment card. It is provided with security data including expiry date, and the reverse side has a CVV code, which generally consists of three numbers.

The payment card includes on at least one side an authentication code comprising a number of characters between 200 and 10,000, the authentication code being unique and belonging to the payment card to which the authentication code is attached, the authentication code comprising: Forming means for identifying the payment card by optical recognition, characterized in that the identification means are linked to a bank account to which the payment card is linked.

The payment card according to the invention comprises a unique authentication code affixed to the side of the payment card. This authentication cipher contains a large number of characters, making it unique. In fact, the authentication cipher serves to provide a means of authenticating the payment card by optical recognition of the authentication cipher. This authenticated encryption contributes to improving the security of secure transactions by limiting phishing scams. In fact, if the hacker succeeds in deactivating the security data of the payment card, the authentication method according to the invention requires verification of the secure transaction by optical recognition of the authentication code. Therefore, if a hacker does not possess the payment card and its security data, that person cannot use the payment card for his or her own benefit.

According to a second feature of the first aspect of the invention, the authentication code is a matrix code forming a predetermined number of black modules arranged against a white background to form a unique pattern, each The black module forms the characters of the authentication code. This type of matrix code provides a large number of combinations that allow each payment card to contain a unique authentication code that is also said to "belong" to that card.

According to a third feature of the first aspect of the invention, the PAN number consists of a quadruple series of four digits, and the payment card includes a PAN code that replaces at least the series of four digits of the PAN number. PAN encryption provides additional security that makes it possible to counter physical theft and/or visual theft of payment cards. In fact, even with physical theft and/or visual theft, the hacker does not have the entire PAN number of the payment card. Therefore, the card cannot be used.

Specifically, the PAN cipher includes 16 to 100 characters, and preferably the PAN cipher includes 36 to 64 characters. According to the invention, the PAN cipher is Cardan Grill.

According to a fourth feature of the first aspect of the invention, the CVV cipher can be replaced by a cipher having a number of characters greater than three. This feature is also intended to hide the security data of the payment card in order to counter physical theft and/or visual theft of the payment card.

A second aspect of the invention relates to a payment card defined according to the first aspect of the invention and a method of authenticating the holder of the payment card. Authentication methods are aimed at performing secure operations regarding the personal data of the payment card holder. In this regard, the authentication method includes at least the following:
a) a first step of authenticating the payment card by entering payment card security data; and/or a first authentication of the payment card holder, wherein the payment card holder enters his or her identification /or a first authentication of entering an identifier;
b) requesting secure operations regarding the personal data of the holder of the payment card, the request being made using a secure digital space linked to the payment card's bank account that is open to a financial institution; The steps are executed and stored in a secure digital space on a remote server managed by the financial institution;
c) verifying the entered security data of the payment card, carried out by comparing the entered security data with reference data stored in a secure digital space;
d) a second step of authenticating the payment card and the holder of the payment card, the second authentication step being carried out by recognition of an authentication code belonging to the payment card; a second step performed by a digital recognition module available or accessible via the associated digital terminal;
e) terminating the secure operation regarding the personal data of the payment card holder.

Through two authentication steps a) and d), the method according to the invention incorporates a two-factor authentication of the payment card and/or the holder of said card. This two-factor authentication enhances the security of secure transactions such as remote payments. In fact, this method involves entering the security data of the payment card, but the holder of this card who performs this transaction has to open the recognition module, and finally, the holder of the payment card You must own your own payment card for the crypto belonging to the payment card to be used. In fact, this kind of hacking makes the authentication method ineffective as it currently exists, since it is not possible to recover the authentication encryption belonging to the payment card.

According to a first feature of the second aspect of the invention, the second authentication step d) establishes a secure communication channel between the secure digital space of the bank account and the digital terminal of the holder of the payment card. Performed by opening the secure digital space of the bank account requires opening the digital recognition module.

According to a second feature of the second aspect of the invention, the authentication method comprises a biometric and/or code authentication operation of the payment card holder upon opening the recognition module; If the authentication is successful, the recognition module grants access to the digital terminal's camera to enable digital capture of the payment card's authentication code.

According to a third feature of the second aspect of the invention, the method comprises: comparing the authentication code attached to the payment card with a digital image of the authentication code stored in a secure digital space of the bank account. including.

According to a fourth feature of the second aspect of the invention, when the connecting step a) is performed in a secure online portal separate from the secure digital space 6, the secure communication channel and a secure digital space linked to your payment card's bank account.

According to a fifth feature of the second aspect of the invention, the authentication method comprises the step of location information of the digital terminal of the holder of the payment card.

A third aspect of the invention relates to the use of the authentication method defined by the second aspect of the invention for enabling remote payments, in particular remote payments carried out via a website, wherein the remote payment is , via a payment card defined according to the first aspect of the invention.

Other features and advantages will become apparent in the following detailed description of two non-limiting exemplary embodiments of the invention, illustrated by the accompanying FIGS. 1-6.
1 shows the front side of a payment card according to the invention; FIG. Figure 2 shows the back side of the payment card of Figure 1; FIG. 2 illustrates a digital terminal receiving a call from a bank server to authenticate a payment card. 3 is a diagram illustrating the steps of recognition of the authentication code of the payment card of FIGS. 1 and 2; FIG. 1 illustrates a system and method for authenticating payment cards according to a first exemplary embodiment of the invention; FIG. FIG. 2 illustrates a system and method for authenticating payment cards according to a second exemplary embodiment of the invention.

As shown in FIGS. 1-5, the invention relates to a payment card 1. As shown in FIGS. This payment card 1 corresponds to a bank card. In fact, the payment card 1 according to the invention is connected to a financial account opened at a banking institution. The bank account and payment card 1 are assigned to a user, also referred to as the bank account owner or the payment card 1 holder 100.

Payment card 1 includes a front side 10 and a back side 11. Conventionally, the payment card 1 also incorporates an electronic chip 12. The electronic chip 12 includes a processor and memory configured to execute algorithms and/or store data.

As shown in FIG. 1, the front side 10 includes security data 2. As shown in FIG. Security data 2 includes at least one PAN number 20. The PAN number 20 is composed of several series of numbers, for example, four numbers in a quadruple series, for a total of 16 numbers. The term "PAN" is common in banking jargon. In this example, by reading the payment card 1 from left to right, the PAN number 20 is divided into a first series of digits 200, a second series of digits 201, a third series of digits, and a fourth series of digits. The number 203 is included.

As shown in FIG. 1, it is possible to replace at least a series of four digits of a PAN number 20 with a PAN cipher 21. In this example, PAN cipher 21 replaces the third series of digits in PAN number 2. However, alternatively, it is possible that the PAN cipher 21 replaces the fourth series of digits 203 of the PAN number 2.

According to the invention, the PAN cipher 21 includes 16 to 100 characters. Preferably, PAN cipher 21 includes 36 to 64 characters. In the example of FIG. 1, the PAN cipher 21 consists of a cardan grill. Nevertheless, it is possible to envisage the use of other types of PAN codes 21, such as linear barcodes or matrix barcodes.

It is noted that this technique of encrypting PAN numbers using Cardan Grill as PAN cipher 21 is described in more detail in WO 2020/120849 filed by the applicant. Furthermore, a method for digitally revealing a sequence of encrypted numbers is described in French patent application no. 2005961, also filed by the applicant. As explained in the introduction, the encryption of the sequence of digits of the PAN number 21 effectively makes it possible to counter identity theft fraud, especially after physical theft of a payment card.

As shown in FIG. 1, the security data 2 also includes identification information 22 of the holder 100 of the payment card 1. Furthermore, the security data 2 includes the expiration date 23 of the payment card 1.

Conventionally, the security data 2, 20, 21, 22, 23 attached to the front side 10 of the payment card 1 is imprinted by printing and/or embossing onto the front side of the payment card 1 or even by screen printing. In this embodiment, except for the printed PAN code 21, other security data 2, 20, 22, 23 are attached by embossing.

As shown in FIG. 2, the back side 11 has a CVV code 24. This CVV code 24 is generally three numbers. Optionally, it is also possible to replace the CVV cipher 24 with a cipher having more than three characters. Instead of the CVV code 24, codes such as cardan grills, linear barcodes, or matrix barcodes can be used for the information.

The CVV cipher 24 also utilizes the security data 2 of the payment card 1. These security data 2 are called security data since they are used to authenticate the payment card 1 at the bank administration during remote payments.

According to the invention, the payment card 1 includes at least one authentication code 3. It is unique and belongs to payment card 1. This authentication code 3 constitutes means for authenticating the payment card 1 by optical recognition. It is linked to the payment card 1's bank account.

The authentication code 3 can be affixed to one side 10, 11 of the payment card 1. In the embodiment of FIG. 2, the authentication code 3 is attached to the back side 11. However, the authentication code 3 can also be made available on the front side 10 of the payment card 1.

According to the invention, the authentication cipher 3 contains a number of characters from 200 to 10,000.

In the embodiments shown in FIGS. 2, 4 and 5, the authentication code 3 consists of a matrix code. Matrix codes are also called "two-dimensional barcodes." In reality, the matrix code consists of a predetermined number of black modules arranged against a white background to form a single pattern. Thus, each black module constitutes one character of the authentication code 3. Each black module has predetermined dimensions. This type of matrix code is known as a QR code. The large number of characters in the authentication cipher 3 makes it unique.

It should be noted that the authentication cipher 3 can be formed by another type of visual cipher, such as a holographic cipher, a cardan grill, etc. The advantage of Data Matrix type cryptography lies in its already established ability to be read and recognized by smartphones and current banking applications.

As shown in FIGS. 5 and 6, the invention also relates to an authentication system 4 for a payment card 1 and a holder 100. As shown in FIGS. The two-factor authentication of the holder 100 and his payment card 1 contributes to performing secure operations regarding the personal data of the holder 100 of the payment card 1. For example, a secure transaction may correspond to a remote payment performed using payment card 1 (FIG. 5). This two-factor authentication is particularly useful for remote payments over the Internet. However, two-factor authentication can also be used to perform digital signatures, transactions on customer accounts, transfers of bank funds, etc.

In the embodiments of FIGS. 5 and 6, the authentication system 4 comprises a digital terminal 5. In the embodiment of FIGS. The digital terminal 5 may be composed of a smartphone, a digital tablet, or the like. More broadly, the invention may be practiced using an electronic device with a display means such as a screen, a multimedia capture tool such as a still or video camera, memory, and a processor for storing and executing algorithmic applications. is possible. The electronic device may also be equipped with means of communication via a telecommunications network, such as a mobile telephone network, a wireline telephone network, or the Internet.

According to the invention, the digital terminal 5 incorporates a module 50 for the recognition of the authentication code 3 belonging to the payment card 1 . The recognition module 50 is configured for digital capture of the authentication cipher 3. For these purposes, the recognition module 50 is integrated into an application system configured to control the camera of the digital terminal 5. By way of example, the recognition module 50 can be integrated into an application for managing bank accounts linked to the payment card 1. This application for managing bank accounts is of course stored and executed by the digital terminal 5. Note herein that each financial institution makes a bank management application available to its clients. The recognition module 50 can thus be added to an already existing application or is an algorithm brick corresponding to the application algorithm itself.

Digital terminal 5 is configured to communicate remotely via a wireless communication network. For this purpose, the digital terminal 5 may be equipped with communication means, such as a mobile phone transceiver. By way of example, the transceiver may be of GSM, 2G, 3G, 4G, 5G, 6G type. In addition, the digital terminal 5 may include a short-range transceiver such as Bluetooth (registered trademark) or Wi-Fi. Note that most digital terminals are equipped with a Wi-Fi transceiver and a Bluetooth transceiver. Furthermore, the mobile phone or smart phone further includes a mobile phone transceiver.

As shown in FIGS. 5 and 6, the authentication system 4 according to the invention further comprises a secure digital space 6. As shown in FIGS. The secure digital space 6 is linked to the payment card 1's bank account. Generally, the secure digital space 6 is managed by a financial institution that manages the bank account of the holder of the payment card 1. The secure digital space 6 is stored by a remote server. In known manner, this secure digital space 6 is remotely accessible via a secure protocol such as a service call. This service call is the same type used by electronic payment terminals (EPTs) to perform bank payments after reading a bank payment card.

Typically, service calls can be protected by security protocols such as APA, HTTPS, or OAuth2.

The secure digital space 6 is also configured to open a secure communication channel using, for example, a PSP or "payment service provider" type payment verification system. Such PSP payment verification systems correspond to application programming interfaces, also referred to as "APIs." The API of this payment verification system is configured to open a secure communication channel between the secure digital space 6 and the bank account owner in order to verify remote payments. In this embodiment, the payment verification system used is configured to establish a secure communication between the secure digital space 6 and the digital terminal 5 of the holder 100 of the payment card 1 linked to the bank account in question. configured.

In the example shown in FIG. 5, authentication system 4 may comprise a secure online portal 7. In the embodiment shown in FIG. The online portal 7 itself is stored on a remote server separate from the bank server. In this example, the online portal 7 is configured to communicate with a remote server that stores the secure digital space 6 of bank accounts. When the bearer 100 wishes to perform an online payment transaction, the online portal 7 is a payment portal hosted on a website, such as a commercial site.

According to the invention, the online portal 7 is configured to perform secure operations regarding the personal data of the holder 100 of the payment card 1. Such secure transactions may correspond to remote payments, digital signatures, transactions on customer accounts, transfers of bank funds, etc., as described above.

In the example of FIG. 6, the online portal 7 may be the same as the secure digital space 6. This possibility is more specific for bank transfer transactions or transactions on customer cards. In this configuration, bearers 100 communicate directly with their digital terminals 5 via a secure digital space 6.

In connection with the authentication system 4, the secure digital space 6 is therefore configured to communicate remotely with the digital terminal 5 and/or the online portal 7 via a wireless communication network.

In all cases, secure operations regarding the personal data of the bearer 100 are performed after two-factor authentication of the payment card 1 and the bearer 100 of the payment card 1. In fact, the authentication system 4 includes a first conventional authentication in all online payment transactions. This first authentication corresponds, on the one hand, to the authentication of the bearer 100 by connection to a personal digital space. This authentication of the bearer 100 includes entering an identifier and password, or biometric recognition. On the other hand, the first authentication also includes information regarding the security data 20, 21, 22, 23, 24, 200, 201, 203 of the payment card 1. Note that in this example, PAN number 20 includes a PAN cipher 21. If the bearer 100 does not have in its memory the sequence of digits substituted by the PAN cipher 21, the bearer 100 may, according to French patent application no. This set of numbers can be revealed through the visualization method described. In the example of FIG. 5, the first authentication is performed by connecting to the online portal 7. Conversely, in the embodiment of FIG. 6, the first authentication is performed directly from the secure digital space 6 linked to the payment card 1.

Second, authentication system 4 includes a second authentication. This second authentication takes place via a secure communication channel opened between the secure digital space 6 and the digital terminal 5 of the holder 100 of the payment card 1 .

In practice, this second authentication corresponds, on the one hand, to the authentication of the bearer 100 by entering a password or by biometric recognition via the recognition module 50. If the authentication of the holder 100 of the payment card 1 is successful, the recognition module 50 performs a second authentication of the payment card 1. This second authentication involves reading or capturing the authentication code 3 of the payment card 1. In fact, this two-factor authentication is a condition for approving a secure transaction, since the bearer 100 is in possession of his payment card 1 during the verification of the transaction. Without the bearer's 100 biometric data or the authentication code 3, the hacker will not be able to effectuate a secure transaction. Furthermore, an additional level of security is provided by the payment card 1 equipped with a PAN cipher 21.

The invention also relates to a compliant payment card 1 according to the invention and a method for authenticating the holder 100 of this payment card 1. This authentication is performed in order to carry out secure operations regarding the personal data of the holder 100 of the payment card 1. According to the invention, this authentication method can be used to authorize remote payments, in particular remote payments carried out via a website. However, the method according to the invention may also be useful for performing financial transactions, transactions on customer accounts, digital signatures, etc.

As shown in FIGS. 5 and 6, the authentication method includes a first step of authenticating the payment card 1 and the holder 100 of the payment card 1. As shown in FIGS. This first authentication step is called a). During this step a), the holder 100 enters the security data 20, 21, 22, 23, 24, 200, 201, 203 of the payment card 1. In practice, step a) may also include the authentication of the identity of the holder 100 of the payment card 1. This authentication is done by connecting to a secure digital space. Connecting includes entering an access code and/or a biometric identifier. Biometric recognition can be digital or facial. This functionality relies on features built into the digital terminal 5 of the holder 100 of the payment card 1.

As shown in FIGS. 5 and 6, the authentication method includes the step of requesting a secure operation regarding the personal data of the holder 100 of the payment card 1. The request step is indicated by b). According to the invention, the request is made using a secure digital space 6 linked to the bank account of the payment card 1. Naturally, this bank account is opened at a financial institution. In this example, secure digital space 6 is stored on a remote server managed by a financial institution. As mentioned above, the secure digital space 6 is remotely accessible via current telecommunication means (Internet, mobile phone).

The authentication method includes the step of verifying the entered security data 20, 21, 22, 23, 24, 200, 201, 203 of the payment card 1. This step is indicated by c). Verification step c) is performed by comparing the entered security data 20 , 21 , 22 , 23 , 24 , 200 , 201 , 203 with reference data stored in the secure digital space 6 . If this step is successful, the method according to the invention requires a second authentication in order to enable operations regarding the personal data of the holder 100 of the payment card 1.

For these purposes, the authentication method includes a second step of authenticating the payment card and the holder of the payment card. This second authentication step is indicated by d). According to the invention, the second authentication step is carried out by recognition of the authentication code 3 of the payment card 1.

In this example, step d) is carried out via a digital recognition module 50 available or accessible to the digital terminal 5 belonging to the holder 100 of the payment card 1 . In practice, the second authentication step d) is carried out by opening a secure communication channel between the secure digital space 6 and the digital terminal 5 of the holder 100 of the payment card 1. Such a secure communication channel may use the PSP system described above. In fact, the secure digital space 6 of the bank account requires opening the digital recognition module 50 on the digital terminal 5 of the holder 100 of the payment card 1.

As shown in FIG. 3, when the recognition module 50 is opened, the method may include a biometric and/or coded authentication transaction of the holder 100 of the payment card 1. In this embodiment, biometric authentication based on fingerprint 51 recognition is required. In the case of authentication of the holder 100 of the payment card 1, the recognition module 50 grants access to the camera of the digital terminal 5 in order to enable digital capture of the authentication code 3 belonging to the payment card 1 (see FIG. 4). . The recognition module 50 includes a frame 52 in the payment card 1 that must be placed through the screen of the digital terminal 5. Note that the recognition module 50 asks to scan the payment card 1.

The second authentication step involves the transaction of comparing the authentication code 3 attached to the payment card 1 with a digital reference image of the authentication code. This reference image is stored in the secure digital space 6 of the bank account. If the reference image corresponds to the code 3 attached to the payment card, the second authentication step is considered successful.

Although the secure transaction may be immediately aborted if the second authentication step fails, the method may allow the payment card holder 100 to attempt a predetermined number of recognition tests. For example, it is possible to provide three authentication cipher 3 recognition tests before a secure transaction is interrupted due to a failure of two-factor authentication of the payment card 1 and its holder's 100 identity. In case of initial failure, it is also possible to switch to a more conventional authentication method, such as the secure 3D system described in the introduction of this specification.

However, in the case of the second authentication step d), the authentication method includes the step of terminating the secure operation regarding the personal data of the holder 100 of the payment card 1. The termination step is indicated by e). In effect, the termination step sends permission to proceed with the secure transaction.

In addition, the authentication method may include a step of location information of the digital terminal 5 of the holder 100 of the payment card 1. The location of the holder 100 of the payment card 1 may provide information regarding fraud attempts. Indeed, if the digital terminal 5 is located in a different country than the country in which the bank account was opened, an alert can be generated that is sent to the bearer 100. In practice, the recognition module 50 is configured to access location data of the digital terminal 5. Alternatively, the IP address of the digital terminal 5 may make it possible to provide information regarding the location information of the holder 100 of the payment card 5.

In short, the purpose of this location information is the same as the input of the security data 20, 21, 22, 23, 24, 200, 201, 203 of the payment card 1 and the recognition of the authentication code 3, especially the QR code (registered trademark). It is to ensure that it is run from place.

According to the first exemplary embodiment shown in FIG. is executed. This possibility is very common and corresponds to purchases made by the holder 100 of the payment card 1 on the online portal 7 of a commercial site. According to this embodiment, the bearer 100 enters the security data 20, 21, 22, 23, 24, 200, 201, 203 directly into the secure digital space of the online portal 7.

Request step b) is performed via a secure communication channel opened between the online portal 7 and the secure digital space 6. This channel may be one already in use between the payment service provider and the bank.

In this situation, termination step e) also takes place via this secure communication channel. If the online portal 7 is a payment portal of a commercial website, the final step e) is to send a debit authorization between the financial institution of the payment card 1 and the financial institution to which the payment portal is assigned. The online portal 7 may also require a digital signature provided through the authentication method of the invention. In this case, the verification step e) transmits an authorization or a digital signature.

According to a second exemplary embodiment of the method shown in FIG. 6, the first authentication step a) is performed following the connection of the payment card 1 to a secure digital space 6 linked to a bank account. Ru. According to this embodiment, the bearer 100 identifies himself to the secure digital space 6. In practice, the bearer 100 authenticates himself by entering his identification information via an identifier. This identifier is verified by password and/or biometric recognition (digital or facial recognition).

According to this embodiment, request step b) is performed within the secure digital space 6. In this situation, the final step e) is carried out directly from the financial institution, for example in order to carry out an intra-bank transfer, ie between two bank accounts opened at the same institution. These two bank accounts can belong to the same holder 100 or to two different entities. Alternatively, if a financial transaction between two banking organizations is involved, the termination step consists of transferring authorization to debit the bank account of the holder 100 of the payment card 1 and credit it to the receiving financial institution.

International Publication No. 2020/120849 French Patent Application No. 2005961

Claims (14)

A payment card (1) comprising a front side (10) and a back side (11), incorporating an electronic chip (12), said front side (10) having at least one PAN number (20) and said payment card comprising security data (2) comprising identification information (22) of the holder of (1) and an expiration date (23) of said payment card (1), said back side (11) preferably consisting of three numbers; comprising on one side (10, 11) a unique authentication code (3) belonging to said payment card (1), having a CVV code (24) of It is attached to
Said authentication code (3) forms means for identifying said payment card (1) by optical recognition, said identification means being a payment card linked to a bank account to which said payment card (1) is linked. (1). Said authentication code (3) is a matrix code forming a predetermined number of black modules arranged against a white background to form a unique pattern, each of said black modules being connected to said authentication code (3). Payment card (1) according to claim 1, forming the characters . 1 . The payment card ( 1 ) according to claim 1 , wherein the PAN number ( 20 ) consists of a quadruple series of four numbers, and the payment card ( 1 ) includes a PAN code ( 21 ) replacing the PAN number ( 20 ) of at least a series of four numbers. or the payment card described in 2 (1). Payment card (1) according to claim 3, wherein said PAN cipher (21) comprises 16 to 100 characters, preferably said PAN cipher (21) comprises 36 to 64 characters. Payment card (1) according to claim 3 or 4, wherein the PAN cipher (21) is Cardan Grill. Payment card (1) according to any one of the preceding claims, wherein the CVV cipher (24) is replaced by a cipher with a number of characters greater than 3. Payment card (1) according to any of the preceding claims, wherein the authentication code (3) comprises a number of characters from 200 to 10,000. A method for authenticating a payment card (1) according to any one of claims 1 to 7 and a holder (100) of said payment card (1), comprising: With the aim of performing secure operations regarding the personal data of the holder (100), the authentication method comprises at least:
a) a first step of authenticating said payment card (1) by entering security data (2, 20, 200, 201, 203, 22, 23) of said payment card (1); and/or said payment; a first authentication of said holder (100) of said payment card (1), wherein said holder (100) of said payment card (1) enters her identification information and/or identifier; ,
b) requesting secure operations regarding the personal data of the holder (100) of the payment card (1), the request comprising: carried out using a secure digital space (6) linked to said bank account, said secure digital space (6) being stored on a remote server managed by said financial institution;
c) verifying the entered security data of the payment card (1), the step of verifying the entered security data (2, 20, 200, 201, 203, 22, 23) in the secure digital space; (6) performed by comparing with reference data stored in
d) a second step of authenticating said payment card (1) and said holder (100) of said payment card (1), said second authentication step comprising: said payment card (1) belonging to said payment card (1); This step is carried out by the recognition of an authentication code (3), this step being performed by a digital recognition module (50) available or accessible via a digital terminal (5) belonging to said holder (100) of said payment card (1). a second step, performed by;
e) terminating the secure operation regarding the personal data of the holder (100) of the payment card (1). Said second authentication step d) comprises a secure communication between said secure digital space (6) of said bank account and said digital terminal (5) of said holder (100) of said payment card (1). 9. Authentication method according to claim 8, carried out by opening a channel, the secure digital space (6) of the bank account requiring the opening of the digital recognition module (50). Said authentication method comprises a biometric and/or code authentication transaction of said holder (100) of said payment card (1) upon opening said recognition module (50); 100), said recognition module accesses a camera of said digital terminal (5) to enable digital capture of said authentication code (3) of said payment card (1). The authentication method described in 8 or 9. comprising comparing the authentication code (3) attached to the payment card (1) with a digital reference image of the authentication code (3) stored in the secure digital space (6) of the bank account. , the authentication method according to any one of claims 8 to 10. When said connecting step a) is performed on a secure online portal (7) separate from said secure digital space (6), a secure communication channel is provided between said secure online portal (7) and said payment card. Authentication method according to any one of claims 8 to 11, opened with a secure digital space (6) linked to the bank account of (1). Authentication method according to any one of claims 8 to 12, comprising the step of location information of the digital terminal (5) of the holder (100) of the payment card (1). 13. Use of the authentication method according to any one of claims 8 to 12 for enabling remote payments, in particular remote payments carried out via a website, wherein said remote payments are performed according to claim 1. Use made via a payment card (1) according to any one of paragraphs 1 to 7.

Images